ISO 31000:2018

Overview

ISO 31000:2018 - Risk management - Guidelines provides a unified, organization‑wide approach to managing risk. It offers adaptable guidance that can be customized to any organization, sector or activity and used throughout the organization’s lifetime. The standard defines core terms (for example, risk = “effect of uncertainty on objectives”) and presents a structured set of principles, a framework, and a risk management process to help organizations make informed decisions and protect or create value.

Key Topics

• Scope and purpose: Guidelines applicable to any organization and decision‑making at all levels; not industry specific.
• Terms and definitions: Clear definitions for risk, risk management, stakeholder, event, consequence, likelihood and control.
• Principles of effective risk management: Integrated, structured and comprehensive, customized, inclusive, dynamic, and based on the best available information.
• Risk management framework: Leadership and commitment, integration with governance, design (context, roles, resources, communication), implementation, evaluation and continual improvement.
• Risk management process:
  • Communication and consultation
  • Scope, context and criteria (defining external/internal context and risk criteria)
  • Risk assessment - identification, analysis and evaluation
  • Risk treatment - selection and implementation of options, treatment planning
  • Monitoring, review, recording and reporting

Applications

ISO 31000:2018 is practical for organizations seeking to:

• Embed consistent risk thinking into strategy, governance and operational decision‑making
• Improve resilience, protect assets and support performance and innovation
• Standardize risk assessment, treatment and reporting across projects, business units and functions Typical users include top management, risk officers, governance and compliance teams, project managers, auditors, consultants and stakeholders involved in strategic or operational decision‑making. The standard is useful for designing or improving a risk framework, aligning risk activities with objectives, and integrating risk into management systems.

Related Standards

• Prepared by ISO/TC 262 (Risk management); this second edition replaces ISO 31000:2009.
• ISO 31000:2018 is intended to complement an organization’s existing management systems and governance arrangements, providing principles and a process that can be integrated with other management approaches.

Keywords: ISO 31000:2018, risk management, risk assessment, risk treatment, risk framework, risk management principles, risk guidelines.